Limit visibility of internal state structure
Fix validation of positive responses consisting of multiple wildcards
Store trust anchors always DS in memory.

This ensures that all DNSKEYs from a zone are retrieved. This is
necessary as the local trust anchor might only be the SEP/KSK and not
the key used to sign the records (ZSK). The retrieved DNSKEY RRset is
validated with the generated DS.
Remove validation code that deals with DNSKEY trust anchors

DNSKEY trust anchors are converted to DS records at load time